................
void RtlInitUnicodeString(PUNICODE_STRING UnicodeString,PWSTR Buffer)
{ UnicodeString->Buffer=Buffer;
UnicodeString->Length=wcslen(Buffer)*2;
UnicodeString->MaxLength=wcslen(Buffer)*2;}
int APIENTRY WinMain(HINSTANCE hInstance,
HINSTANCE hPrevInstance,
LPSTR lpCmdLine,
int nCmdShow)
{
_NtOpenFile NtOpenFile=(_NtOpenFile)GetProcAddress(GetModuleHandle("ntdll.dll"),"NtOpenFile");
OBJECT_ATTRIBUTES oa;UNICODE_STRING on;IO_STATUS_BLOCK iosb;FourByte FileHandle,r;char str[255];
RtlInitUnicodeString(&on,L"[url=file://\\Device\\HarddiskVolume1]\\Device\\HarddiskVolume1[/url]");
//RtlInitUnicodeString(&on,L"[url=file://\\??\\C:\\]\\??\\C:\\[/url]");
oa.Length=sizeof(OBJECT_ATTRIBUTES);
oa.ObjectName=&on;
oa.Attributes=0x40;
oa.RootDirectory=oa.SecurityDescriptor=oa.SecurityQualityOfService=0;
r=NtOpenFile(FileHandle,GENERIC_READ,&oa,&iosb,5,0);
itoa(r,(char*)&str,16);
MessageBox(0,(const char*)&str,"a",0);
return 0;
}
.................
比如说用NtOpenFile打开文件，如果文件名是\Device\HarddiskVolume1且企求的访问是GENERIC_READ或GENERIC_WRITE等就会被拦截，我认为只要拦截WRITE操作就行了，读操作不会破坏硬盘。而且瑞星不会拦截打开\??\C:\的操作，但\??\C:\转换后就是\Device\HarddiskVolume1。瑞星最好做好拦截驱动程序操作硬盘的工作，驱动程序完全可绕过瑞星的SSDT重定向。在SSDT重定向做再多hook NtOpenFile,NtCreateFile的事，驱动程序一个IoCreateFile或IoCallDriver就完了。
